CVE Vulnerability Advisory Database

[Affected Scope] Roundcube Webmail versions through 1.5.7 and 1.6.x through 1.6.7

[Impact] A remote attacker can execute malicious scripts in the victim's browser session by sending a crafted email, enabling unauthorized access, theft, and transmission of the victim's emails.

[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions (1.5.8, 1.6.8, or later).

[Affected Scope] Apache OFBiz versions up to and including 18.12.14

[Impact] Unauthenticated remote attackers can execute arbitrary screen rendering code and system commands by sending specially crafted HTTP requests

[Mitigation] Immediately upgrade Apache OFBiz to the latest stable version 18.12.15 or higher

[Affected Scope] Acronis Cyber Infrastructure (ACI) versions prior to 5.0.1-61, 5.1.1-71, 5.2.1-69, 5.3.1-53, and 5.4.4-132

[Impact] Unauthenticated remote attackers can exploit default credentials to execute arbitrary commands and gain full control over the infrastructure

[Mitigation] Immediately upgrade to the patched versions (5.0.1-61, 5.1.1-71, 5.2.1-69, 5.3.1-53, 5.4.4-132 or later)

[Affected Scope] Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0.

[Impact] Unauthenticated remote attackers can exploit this vulnerability via T3 or IIOP protocols to gain unauthorized access to critical data or compromise all accessible data.

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict/disable T3 and IIOP protocols if they are not required.

[Affected Scope] Palo Alto Networks Expedition versions prior to 1.2.92

[Impact] Attackers with network access can bypass authentication to take over the Expedition administrator account, exposing firewall configurations, credentials, and API keys

[Mitigation] Immediately upgrade Expedition to version 1.2.92 or later, and restrict network access to authorized administrator IPs only

[Affected Scope] ServiceNow Now Platform Washington DC, Vancouver, and earlier releases

[Impact] An unauthenticated remote attacker can execute arbitrary code within the context of the Now Platform due to improper input validation

[Mitigation] Apply the official security patches and hotfixes released during the June 2024 patching cycle immediately

[Affected Scope] ServiceNow Now Platform Vancouver and Washington DC releases

[Impact] Unauthenticated remote attackers can execute arbitrary code within the context of the Now Platform, potentially leading to full system compromise

[Mitigation] Apply official security patches and hotfixes immediately, and restrict external access for self-hosted instances while monitoring for IoCs

[Affected Scope] MSHTML (Internet Explorer) engine embedded in all supported versions of Windows 10, 11, and Windows Server

[Impact] Attackers can bypass security warnings via specially crafted Internet Shortcut (.url) files, leading to arbitrary code execution and complete system compromise

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and restrict the execution of untrusted .url and .lnk files

[Affected Scope] Microsoft SharePoint Server 2016, 2019, and Subscription Edition

[Impact] An authorized attacker with Site Owner permissions can execute arbitrary code within the server context via specially crafted API requests, leading to full system compromise

[Mitigation] Apply the official Microsoft Cumulative Update (CU) patches immediately, restrict administrative privileges, and audit system logs for indicators of compromise

[Affected Scope] Windows 10, Windows 11, and Windows Server environments running the Hyper-V virtualization platform

[Impact] Local attackers with low-privilege access can exploit an integer overflow (CWE-190) to execute arbitrary code with SYSTEM privileges, leading to complete host compromise

[Mitigation] Immediately apply Microsoft's July 2024 cumulative security updates and restrict local access to virtualization hosts

[Affected Scope] Twilio Authy API endpoints accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0

[Impact] Unauthenticated attackers can verify whether specific phone numbers are registered with Authy, enabling large-scale enumeration and targeted phishing/social engineering attacks

[Mitigation] Immediately update mobile applications to the latest versions (Android 25.1.0+ / iOS 26.1.0+) and enforce strict rate limiting on API gateways

[Affected Scope] Apache HTTP Server versions 2.4.59 and earlier, specifically environments utilizing mod_rewrite rules where substitutions in server context use backreferences or variables as the first segment.

[Impact] Attackers can map URLs to restricted filesystem locations, leading to unauthorized source code disclosure or arbitrary code execution (RCE).

[Mitigation] Immediately upgrade Apache HTTP Server to version 2.4.60 or later, and review/restrict unsafe RewriteRules.

[Affected Scope] Cisco NX-OS Software running on Nexus series switches with authenticated Administrator credentials

[Impact] Authenticated administrators can bypass CLI sandboxing and execute arbitrary commands as root on the underlying Linux operating system due to insufficient argument validation

[Mitigation] Apply official Cisco NX-OS software updates immediately and restrict administrative CLI access using robust AAA and ACLs

[Affected Scope] All default installations of GeoServer prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2

[Impact] Unauthenticated remote attackers can execute arbitrary system commands on the host server via manipulated OGC request parameters

[Mitigation] Immediately upgrade to patched versions (2.22.6, 2.23.6, 2.24.4, 2.25.2 or higher) or apply the workaround by removing the 'gt-complex' JAR file

[Affected Scope] Progress WhatsUp Gold versions prior to 2023.1.3

[Impact] Unauthenticated remote attackers can execute arbitrary commands with 'iisapppool\ mconsole' privileges, leading to full system compromise

[Mitigation] Immediately upgrade WhatsUp Gold to version 2023.1.3 or later and restrict external access

[Affected Scope] VMware ESXi hosts configured to use Active Directory (AD) for user management.

[Impact] A malicious actor with group creation permissions in AD can gain full administrative access to the ESXi host by re-creating the deleted 'ESXi Admins' group.

[Mitigation] Apply the official security patches from Broadcom or change the default ESXi Admins group setting to an unprivileged/non-existent group name.

[Affected Scope] VMware vCenter Server versions 7.0 and 8.0, and VMware Cloud Foundation versions 4.x and 5.x.

[Impact] An unauthenticated remote attacker can trigger a heap-based buffer overflow to execute arbitrary code with root privileges by sending crafted network packets.

[Mitigation] Immediately upgrade to the patched versions (vCenter 8.0 U2b / 7.0 U3r or higher) and restrict network access to DCERPC-related ports.

[Affected Scope] End-of-Life (EOL) GeoVision devices including GV-VS12, GV-VS11, and GV-DSP LPR V3

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges, potentially leading to full device takeover and integration into IoT botnets like Mirai

[Mitigation] Since these devices are EOL and no official patches are available, immediately isolate the affected devices from the internet or replace them with supported models

[Affected Scope] Google Pixel devices and Android-based endpoints running security patch levels prior to 2024-06-01

[Impact] Local attackers can exploit a logic error to bypass security boundaries and achieve local privilege escalation (LPE) without requiring elevated execution privileges

[Mitigation] Immediately apply the official Google June 2024 or later security update to all affected devices

[Affected Scope] Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier

[Impact] Unauthenticated remote attackers can exploit this vulnerability to read arbitrary files and potentially achieve Remote Code Execution (RCE)

[Mitigation] Apply the official Adobe security patches (APSB24-40) or upgrade to the latest secure releases immediately